MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 e026f947c7753442d9996c41a91e5adb60e587d10e64d53ad541b3c0ffbd56ac. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: e026f947c7753442d9996c41a91e5adb60e587d10e64d53ad541b3c0ffbd56ac
SHA3-384 hash: 86137659c0602cdea65ad874f6b6daa79103c95b1253a533559e7f8cc1fec951c42f6fc84f5c161dce82180757b147ea
SHA1 hash: a9915cbebfcc3b01fcf03c4f4ee353d64547fced
MD5 hash: 9b7a76dd419819b7541274a0b029e0f8
humanhash: romeo-hawaii-green-hotel
File name:Consignment InvoiceBL.rar
Download: download sample
Signature AgentTesla
Create hunting rule
File size:671'736 bytes
First seen:2020-07-20 08:22:11 UTC
Last seen:Never
File type: rar
MIME type:application/x-rar
ssdeep 12288:3+KreI1afeDCfR9aAqcdyZNV/J5ximUQgRuvF5ugX5/nIPlmkEh:/reI1HDCZ9afcd2PcmU/uvF5ugX5I9y
TLSH C6E42332912C74572573CAA968635AD5F698EC9301712017F736BCAD8B8CA03A077DFB
Reporter abuse_ch
Tags:AgentTesla rar TNT


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: cloudhost-76087.us-midwest-1.nxcli.net
Sending IP: 209.126.24.247
From: TNT EXPRESS <service@tnt.com>
Subject: AWB Notification: You have A Package With Us
Attachment: Consignment InvoiceBL.rar (contains "Consignment Invoice&BL.exe")

AgentTesla SMTP exfil server:
mail.flood-protection.org:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
69
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/e026f947c7753442d9996c41a91e5adb60e587d10e64d53ad541b3c0ffbd56ac/
Threat name:
ByteCode-MSIL.Spyware.Negasteal
Create hunting rule
Status:
Malicious
First seen:
2020-07-20 08:24:06 UTC
AV detection:
24 of 47 (51.06%)
Threat level:
  2/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=4atpsr6hou2efwmznra2shs23nqolb6rbzsnkowvigz4b755k2wa._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Unknown
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/e026f947c7753442d9996c41a91e5adb60e587d10e64d53ad541b3c0ffbd56ac

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

rar e026f947c7753442d9996c41a91e5adb60e587d10e64d53ad541b3c0ffbd56ac

(this sample)

AgentTesla

Executable exe 82b95ae645cd5014e926471c0ba624cbbf70e27d37eb3c0d09a72faf5a050e71

  
Dropping
MD5 f9bfcd25a95ef59e54ef0815ff2c81d3
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 82b95ae645cd5014e926471c0ba624cbbf70e27d37eb3c0d09a72faf5a050e71

Comments